CVE-2026-109983
Received Received - Intake

Stored DOM-Based XSS in YMC Filter WordPress Plugin

Publication date: 2026-10-17

Last updated on: 2026-10-17

Assigner: Wordfence

Description
The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'post_title' parameter in all versions up to, and including, 3.12.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The autocomplete REST endpoint is registered with a permission callback that unconditionally returns true, meaning any site visitor — including unauthenticated users — can trigger the payload simply by typing in the YMC filter search box, while only Author-level access is required to store it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-17
Last Modified
2026-10-17
Generated
2026-10-17
AI Q&A
2026-10-17
EPSS Evaluated
N/A
NVD
CVE-2026-109983
EUVD
EUVD-2026-103276

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wssoffice21 YMC Filter 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The YMC Filter WordPress plugin has a stored DOM-based Cross-Site Scripting (XSS) vulnerability in versions up to 3.12.19. It occurs because the 'post_title' parameter does not properly sanitize or escape user input. Attackers with author-level access can inject malicious scripts into pages. Even unauthenticated users can trigger the payload via the autocomplete REST endpoint, which has a flawed permission check allowing public access.

Detection Guidance

Check WordPress admin logs for unauthorized script injections in post titles or YMC filter search queries. Inspect browser console for DOM-based XSS errors when using the YMC filter search box. Review plugin files for the autocomplete REST endpoint registration without proper permission checks.

Impact Analysis

This vulnerability allows attackers to inject malicious scripts into your WordPress site. If exploited, these scripts can steal user data, hijack sessions, or deface pages. Since the payload executes when users access infected pages, it poses a risk to all visitors, including administrators and regular users.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR and HIPAA requirements for protecting user data. If exploited, it may result in unauthorized access to personal or sensitive information, leading to legal penalties, fines, or reputational damage for organizations handling regulated data.

Mitigation Strategies

Update the YMC Filter plugin to version 3.12.20 or later. Remove or disable the plugin if not essential. Implement strict input sanitization for post titles and restrict author-level access to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109983. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart